Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

B 1
spicedb
Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).
v1.56.024.3 MB
IdentitystandardApache-2.0
A+
static
Tiny static base for self-contained binaries from Go or Rust. Nonroot, no shell, no package manager. The only image tagged :latest.
v20260621617.2 KB
Runtime basestandardMIT
B 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.
v0.30.229.6 MB
Security & supply chainstandardApache-2.0
D 3
syft
Anchore's CLI for generating Software Bills of Materials (SBOMs) from container images and filesystems. Image only, no chart.
v1.50.028.6 MB
Security & supply chainstandardApache-2.0
B 3
tekton
Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on a hardened nonroot Wolfi base.
v1.14.0117.0 MB
CI/CD & registrystandardApache-2.0
B 1
Tempo
Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.
v3.0.239.5 MB
ObservabilitystandardAGPL-3.0
B 3
Temporal
Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.
v1.31.261.5 MB
WorkflowstandardMIT
B 1
Temporal CLI
Command-line client and built-in dev server for Temporal, used to start workflows, inspect history, and run a local cluster.
v1.8.241.4 MB3 versions
WorkflowstandardMIT
A+
tigerbeetle
Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.
v0.17.911.6 MB3 versions
DatabasestandardApache-2.0
A+
timescaledb
PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).
v2.29.0148.1 MB3 versions
Time seriesstandardApache-2.0
C 3
tomcat
Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.
v11.0.2486.9 MB
GatewaycriticalApache-2.0
B 1
Traefik
Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.
v3.7.1054.3 MB
GatewaystandardMIT